#!/usr/bin/perl
# sc_BlackList.conf, multi_dnsbl.conf
# Configuration for sc_BLcheck.pl, sc_BLpreen.pl, and Net::DNSBL::MultiDaemon
#
# version 1.14, 11-11-04
#
my $DNSBL = {
## Net::DNSBL::MultiDaemon parameters
# the OPTIONAL name of a file that will contain 'hit' statistics for DNSBLS
# this file will be used to seed the sort order of DNSBL checking if it is
# present and will be updated with the 'added' counts of each run. If it
# is deleted, it will be recreated with a new time tag at the beginning.
#
MDstatfile => '/usr/local/spamcannibal/mdstats.txt',
# The path for the directory where the pid file will live
#
MDpidpath => '/var/run',
# The zone name for this PSEUDO DNSBL
#
MDzone => 'pseudo.dnsbl',
###### The following optional configuration parameters
###### are shown with their default values
#
# Update frequency for the "stats" file, no
# update occurs if there is no new information
#
# MDstatrefresh => 300, # seconds
# The IPaddress that the daemon will listen on.
# The default will listen on ALL interfaces,
# this is probably not what you want. A more
# suitable value for co-installation with bind
# on the same host would be 127.0.0.1
#
MDipaddr => '127.0.0.1',
# The port that the daemon will listen on
#
# MDport => 9953,
# Syslog facility. Specify one of:
# LOG_EMERG LOG_ALERT LOG_CRIT LOG_ERR LOG_WARNING LOG_NOTICE LOG_INFO LOG_DEBU
#
MDsyslog => 'LOG_ERR',
## SpamCannibal parms follow:
# the OPTIONAL name of a file that will contain 'hit' statistics for DNSBLS
# this file will be used to seed the sort order of DNSBL checking if it is
# present and will be updated with the 'added' counts of each run. If it
# is deleted, it will be recreated with a new time tag at the beginning.
#
'STATS' => '/usr/local/spamcannibal/blcheck_stats.txt',
# force the sc_BLpreen script to check every entry in the blcontrib
# database every time it runs. This uses a lot of cpu time and
# bandwidth. See the description of operation in SpamCannibal.pm
# documentation
#
# normally false
#
# 'FORCE_PREEN' => 1,
# A multi-formated array of IP address that will never be tarpitted.
#
# WARNING: if you are using a private network, then you should include the
# address description for the net/subnets that you are using or you might
# find your DMZ or internal mail servers blocked since many DNSBLS list the
# private network addresses as BLACKLISTED
#
# 127./8, 10./8, 172.16/12, 192.168/16
#
# class A xxx.0.0.0/8 255.0.0.0
# class B xxx.xxx.0.0/16 255.255.0.0
# class C xxx.xxx.xxx.0/24 255.255.255.0
# 128 subnet xxx.xxx.xxx.xxx/25 255.255.255.128
# 64 subnet xxx.xxx.xxx.xxx/26 255.255.255.192
# 32 subnet xxx.xxx.xxx.xxx/27 255.255.255.224
# 16 subnet xxx.xxx.xxx.xxx/28 255.255.255.240
# 8 subnet xxx.xxx.xxx.xxx/29 255.255.255.248
# 4 subnet xxx.xxx.xxx.xxx/30 255.255.255.252
# 2 subnet xxx.xxx.xxx.xxx/31 255.255.255.254
# single address xxx.xxx.xxx.xxx/32 255.255.255.255
#
'IGNORE' => [
# # a single address
# '11.22.33.44',
# # a range of ip's, ONLY VALID WITHIN THE SAME CLASS 'C'
# '22.33.44.55 - 22.33.44.65',
# # a CIDR range
# '5.6.7.16/28',
# # a range specified with a netmask
# '7.8.9.128/255.255.255.240',
#
# # you may want these
# '10.0.0.0/8',
# '172.16.0.0/12',
# '192.168.0.0/16',
# this should ALWAYS be here
'127.0.0.0/8', # ignore all test entries and localhost
],
# A multi-formatted array of addresses that will ALWAYS be tarpitted
# formats are the same as above
#
# Block known spammers
'BLOCK' => [
# Webair Internet Development Inc
# WEBAIRINTERNET2
'69.42.64.0/19',
# Webair Internet Development Inc
# WEBAIRINTERNET
'216.130.160.0/19',
# Media Dream Land Inc.
# MDL23-BLK1 (NET-69-42-96-0-1) 69.42.96.0 - 69.42.111.255
'69.42.96.0/20',
],
# A list of COUNTRIES to block entirely
# BBC == Block By Country
#
# To print a complete list of countries and country codes,
# use the utilty script 'list_countries.pl' in the
# Net::DNSBL::MultiDaemon distribution
#
# Use the 2 letter country codes in the array below
#
# i.e. US MX CN TW etc...
#
# 'BBC' => [qw(
# CN
#)],
# Text to append to BLOCK and BBC T_TXT record
# see "errors" below for syntax
#
'REJECT' => 'see: http://www.myhostname.com/',
# FOR A COMPREHENSIVE LIST OF ALL DNSBL ZONES, SEE:
# http://www.openrbl.org
# click "zones"
#
# all dnsbl servers must have a record a config entry as follows:
#
# 'zone.name' => {
# accept => { # a list of codes that are ok to add to tarpit from this DNSBL
# '127.0.0.2' => 'reason',
# '127.0.0.3' => 'reason',
# },
#
# WARNING !!! DO NOT USE THIS OPTION WITH DNSBL HOSTS THAT REPORT TARPIT ACTIVITY
#
# confirm => 1, # optional, confirmation of acceptance of non - 127.0.0.2 codes
#
# response => '127.0.0.3', # optional, our default response code for records
# # added because of queries to this DNSBL server
# # this code will be ignored if it is < 127.0.0.3
# # and 127.0.0.3 will be used in its place
#
# error message to use with this host.
# NOTE: if the DNSBL supplies a TXT record and it contains the string "http://something..." or
# "www.something..." then that will be use for the error string for the matching A record.
# Otherwise, the error string below will be appended to the whatever TXT is returned by the
# DNSBL. If no TXT is returned, then the "reason" code from the "accept" line for the matching
# 127.0.0.X code will be use and the error code below will be appended.
#
# If the error string ending matches /\?.+=$/ or /\?$/
# then the offending IP address will be automagically added
#
# error => 'IP address blocked, see http://www.somehost.com?ip=',
#
# expire => '7d', # optional default expiration if DNSBL can not be reached
# # may be specified in any combination of seconds, minutes, hours, days, weeks
# # i.e. 604800 or 604800s, 10080m, 168h
# # 1w 3d
#
# timeout => 30, # default seconds to wait for dnsbl query to timeout
# WARNING!! The default timeout in sendmail for DNS queries is "5 seconds"
# If this configuration is used with Net::DNSBL::MultiDaemon it is
# recommended that the timeouts here be set to 5 seconds and that the
# timeout parameter in the SENDMAIL m4 configuration build file for lookups be
# extended to at least 15 seconds -- particularly if you invoke reverse lookups
# with the in-addr.arpa parameter below.
#
# define(`confTO_RESOLVER_RETRANS_FIRST', `15s')dnl
# or
# define(`confTO_RESOLVER_RETRANS', `15s')dnl
#
# see: http://www.sendmail.org/m4/tweaking_config.html
#
# Similar precautions must be taken for other MTA's
#
# To check that ip addresses have some kind of reverse DNS entry, add a zone
# for in-addr.arpa as shown below. You must have reverse DNS entries for
# ip blocks 127, 10, 172, 192 or use the IGNORE blocks above to prevent
# rejects for these address blocks as they DO NOT HAVE worldwide RDNS
'in-addr.arpa' => { # check for lack of reverse DNS
# accept is not needed for reverse DNS checking
error => 'MX host should have rDNS - RFC1912 2.1',
timeout => 5,
},
# working, sample file entries
'dnsbl.sorbs.net' => { # see http://www.dnsbl.sorbs.net/using.html
accept => { # list of codes for which we tarpit
'127.0.0.2' => 'open http proxie',
'127.0.0.3' => 'open socks proxie',
'127.0.0.4' => 'open proxy server',
'127.0.0.5' => 'open smtp relay',
# '127.0.0.6' => 'spam supporting ISP',
'127.0.0.7' => 'open web - form mail servers',
'127.0.0.8' => 'blocked hosts',
'127.0.0.9' => 'zombie - hijacked netblock',
'127.0.0.10' => 'dynamic address range',
'127.0.0.11' => 'bad config -- MX or A records inaccurate',
'127.0.0.12' => 'no mail ever sent from these domains',
},
confirm => 1,
error => 'for removal see: http://www.dnsbl.sorbs.net/cgi-bin/lookup?js&IP=',
expire => '30d',
timeout => '15',
},
'dnsbl.njabl.org' => { # see http://dnsbl.njabl.org/use.html
accept => { # list of codes for which we tarpit
'127.0.0.2' => 'open relays',
'127.0.0.3' => 'dial-up/dynamic IP ranges',
'127.0.0.4' => 'spam sources',
'127.0.0.5' => 'multi-stage openrelay',
'127.0.0.8' => 'open web - form mail servers',
'127.0.0.9' => 'open proxy servers',
},
confirm => 1,
error => 'for removal see: http://www.dnsbl.njabl.org/cgi-bin/lookup.cgi?query=',
expire => '30d',
timeout => '15',
},
'relays.ordb.org' => { # see http://www.ordb.org/faq/#usage_dns
accept => {
'127.0.0.2' => '',
},
error => 'for removal see: http://www.ordb.org/submit',
expire => '30d',
timeout => '15',
},
'bl.spamcop.net' => { # see http://spamcop.net/fom-serve/cache/291.html
accept => {
'127.0.0.2' => '',
},
error => 'for removal see: http://www.spamcop.net/w3m?action=checkblock&ip=',
expire => '30d',
timeout => '15',
},
'cbl.abuseat.org' => { # see http://cbl.abuseat.org
accept => {
'127.0.0.2' => '',
},
error => 'for removal see: http://cbl.abuseat.org/lookup.cgi?.submit=lookup&ip=',
expire => '30d',
timeout => '15',
},
'sbl.spamhaus.org' => { # see http://www.spamhaus.org
accept => {
'127.0.0.2' => '',
},
error => 'for removal see http://abuse.net/sbl.phtml?IP=',
expire => '30d',
timeout => '15',
},
'dynablock.njabl.org' => { # see http://dnsbl.njabl.org/use.html
accept => {
'127.0.0.3' => 'dynamic IP address not allowed',
},
error => 'see http://www.dnsbl.njabl.org/cgi-bin/lookup.cgi?query=',
expire => '30d',
timeout => '15',
},
'list.dsbl.org' => { # see http://dsbl.org
accept => {
'127.0.0.2' => '',
},
error => 'for removal see http://dsbl.org/listing?',
expire => '30d',
timeout => '15',
},
# 'spews.dnsbl.net.au' => { # see http://www.spews.org/
# accept => {
# '127.0.0.2' => '',
# },
# error => 'blocked see: http://www.spews.org/ask.cgi?x=',
# expire => '30d',
# timeout => '15',
# },
#
# 'bogons.dnsiplists.completewhois.com' => { # see http://completewhois.com/bogons/
# accept => {
# '127.0.0.2' => 'bogus IP address',
# },
# error => 'see: http://completewhois.com/bogons/',
# expire => '30d',
# timeout => '15',
# },
#
# 'hijacked.dnsiplists.completewhois.com' => { # see http://completewhois.com/bogons/bogons_usage.html
# accept => {
# '127.0.0.2' => 'hijacked IP address',
# },
# error => 'see: http://completewhois.com/bogons/bogons_usage.html#dns',
# expire => '30d',
# timeout => '15',
# },
#
# higher risk
# 'blackholes.five-ten-sg.com' => { # see http://www.five-ten-sg.com/blackhole.php
# accept => {
# '127.0.0.2' => 'spam source',
# '127.0.0.3' => 'dialup address',
# '127.0.0.4' => 'multistage open relay',
# '127.0.0.5' => 'openrelay',
# '127.0.0.6' => 'spam supporting ISP',
# '127.0.0.7' => 'web form',
# '127.0.0.8' => 'relay/open proxy',
# '127.0.0.9' => 'klez source',
# '127.0.0.10' => 'violate TCPA',
# '127.0.0.11' => 'spam supporting freemailer',
# },
# confirm => 1,
# error => 'for removal see http://www.five-ten-sg.com/blackhole.php?ip=',
# expire => '30d',
# timeout => '15',
# },
};